fix(secrets): enforce fail-closed default for plaintext .env fallback (KI-69)

fix(secrets): enforce fail-closed default for plaintext .env fallback #69

Merged

wasabi opened 3 days ago

Changes

Change KOKONUT_ALLOW_PLAINTEXT_ENV default from true to false in .env.example
Gate plaintext .env fallback in 5 shell scripts (seed, seed-pilot, health-check, schema-snapshot, seed-metabase) on KOKONUT_ALLOW_PLAINTEXT_ENV=true
Scripts now reject plaintext .env unless the override env var is explicitly set
Follows the pattern established in backup.sh (already fail-closed)
CI build spec retains KOKONUT_ALLOW_PLAINTEXT_ENV=true as documented exception

Security Impact

Prevents accidental plaintext secret loading in production environments.

Commits were merged into target branch

fix(secrets): enforce fail-closed default for plaintext .env fallback

- Change KOKONUT_ALLOW_PLAINTEXT_ENV default from true to false in .env.example
- Gate plaintext .env fallback in 5 shell scripts (seed, seed-pilot, health-check,
  schema-snapshot, seed-metabase) on KOKONUT_ALLOW_PLAINTEXT_ENV=true
- Scripts now reject plaintext .env unless the override env var is explicitly set
- Follows the pattern established in backup.sh (already fail-closed)
- CI build spec retains KOKONUT_ALLOW_PLAINTEXT_ENV=true as documented exception

3 days ago

a0dcd6bb

wasabi merged 3 days ago
Login to comment

Submitter	wasabi
Target	main
Source	feat/secrets-fail-closed

Jobs

Merge Strategy

Create Merge Commit

Watchers (1)

Reference

pull request KI-69